error Error: unable to get local issuer certificate

Yarn 1.x prints "error Error: unable to get local issuer certificate" followed by a Node.js stack trace. If the registry sends only its leaf, the text is "unable to verify the first certificate" instead.

What it means

Yarn Classic received a certificate chain (leaf and intermediate) from the registry, but Node.js does not trust the root above it. Yarn surfaces the Node.js error unchanged. The registry is usually fine; this machine is missing the company or proxy root that the chain leads to.

Why it happens

• A private registry signed by a company CA

  common

  Artifactory, Nexus or Verdaccio with certificates from an internal CA whose root Node.js does not know.

• A TLS-inspecting proxy that sends its issuing intermediate

  common

  Proxies that send leaf and intermediate but not their root produce this code instead of "self-signed certificate in certificate chain".

• The lockfile points at another registry host

  occasional

  yarn.lock stores full tarball URLs. A lockfile created against a private mirror keeps downloading from that host even when the registry setting changes.

How to fix it

1. 1.

   Set Yarn 1's cafile

   Point Yarn at the company root (or a bundle including public roots, since cafile replaces the defaults for registry requests).

   yarn config set cafile /etc/ssl/private-ca/corp-root-ca.pem

2. 2.

   Or use NODE_EXTRA_CA_CERTS

   Adds the root to Node.js's built-in list for Yarn and for any other Node.js process with the variable.

   export NODE_EXTRA_CA_CERTS=/etc/ssl/private-ca/corp-root-ca.pem
   yarn install --frozen-lockfile

3. 3.

   Yarn 4: httpsCaFilePath

   Yarn 4 prints the failure as "YN0001: RequestError: unable to get local issuer certificate" and takes the CA file from httpsCaFilePath in .yarnrc.yml.

   # Yarn 4: .yarnrc.yml
   httpsCaFilePath: /etc/ssl/private-ca/corp-root-ca.pem

4. 4.

   Check which hosts the lockfile uses

   If resolved URLs point at an internal mirror, the fix belongs to that mirror's certificate or to your trust store, not to the registry setting.

   # Which hosts does the lockfile download from?
   grep -oE 'resolved "https://[^/]+' yarn.lock | sort | uniq -c

← Browse the full signature error database